Merchant Service Agreement

Parties and Binding Agreement

This Merchant Service Agreement ("Agreement") is entered into between:

Party 1 — Service Provider: Arova Digital Enterprise, a company registered in Ghana (Registration No. BN020210126) ("Arova").

Party 2 — Merchant: The business identified in the Merchant Registration Form submitted on the Arova Platform ("Merchant").

Together they are referred to as the "Parties" and individually as a "Party".

By registering on the Arova Platform, clicking 'I Agree', or using the Platform in any capacity, the Merchant agrees to be bound by the terms of this Agreement. If you are registering on behalf of a business entity, you represent and warrant that you have the authority to bind that entity to this Agreement.

1. Definitions

In this Agreement, the following terms have the meanings set out below:

Term	Definition
"Platform"	The Arova Digital Platform, including the merchant portal, customer portal, dashboard, and all related software and services available at arovadigital.com
"Customer Data"	All personal data relating to the Merchant's customers that is collected, stored, or processed through the Platform, including phone numbers, names, transaction history, and points balances
"Data Controller"	The entity that determines the purposes and means of processing personal data — in this Agreement, the Merchant is the data controller of Customer Data
"Data Processor"	The entity that processes personal data on behalf of the data controller — in this Agreement, Arova is the data processor of Customer Data
"Personal Data"	Any information relating to an identified or identifiable natural person, as defined in the Data Protection Act 2012 (Act 843)
"Processing"	Any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion
"Data Breach"	A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data
"Subscription Plan"	The Free, Launch, Growth, or Scale plan selected by the Merchant at registration
"Loyalty Points"	Non-monetary program credits awarded to customers based on purchase transactions recorded on the Platform
"Effective Date"	The date on which the Merchant completes registration on the Platform

2. Services to Be Provided

i. Subject to the Merchant's compliance with this Agreement and payment of applicable subscription fees, Arova agrees to provide the Merchant with access to the Arova Digital Platform for the purpose of operating a digital loyalty program for the Merchant's customers. The specific features and capacity limits available to the Merchant depend on their chosen Subscription Plan.

ii. Arova will use commercially reasonable efforts to maintain Platform availability of 99.9% uptime, excluding planned maintenance and circumstances beyond Arova's reasonable control.

iii. Arova does not guarantee the fitness of the Platform for any specific purpose beyond its described functionality. Arova is under no obligation to provide any services not described in these Terms or agreed in writing.

3. Data Processing Agreement

3.1 Roles of the parties

The Merchant is and shall remain the Data Controller of all Customer Data collected and processed through the Platform. Arova acts as the Data Processor, processing Customer Data solely on the documented instructions of the Merchant and for the purposes of delivering the Platform services. This arrangement is established in accordance with the Data Protection Act 2012 (Act 843).

3.2 Merchant obligations as data controller

The Merchant represents, warrants, and agrees on a continuing basis that it will:

i. Obtain freely given, specific, informed, and unambiguous consent from each customer before enrolling them in the loyalty program — verbal confirmation at the point of enrollment is acceptable provided the Merchant maintains a record of when enrollment occurred.
ii. Inform each customer, at the point of enrollment, that their personal data (including phone number, purchase history, and points balance) will be stored by Arova as data processor on the Merchant's behalf, and that customers may contact the Merchant to exercise their data rights.
iii. Maintain accurate records of customer consent, including the date and method by which consent was obtained, and make such records available to Arova or the Data Protection Commission upon request.
iv. Obtain explicit, separate opt-in consent from customers before including them in any SMS marketing campaign — consent for transactional SMS is not sufficient for marketing SMS.
v. Promptly handle all data subject rights requests received from customers (access, correction, deletion, objection) and notify Arova within 5 business days of any such request that requires Arova's assistance to fulfil.
vi. Not instruct Arova to process Customer Data in any manner that would violate the Data Protection Act 2012 (Act 843) or any other applicable law.
vii. Promptly notify Arova upon becoming aware of any actual or suspected Data Breach affecting Customer Data, within 24 hours of becoming aware.

3.3 Arova obligations as data processor

Arova agrees and undertakes that it will:

i. Process Customer Data only on the documented instructions of the Merchant, except where required to do so by Ghanaian law.
ii. Ensure that all Arova personnel who access Customer Data are subject to binding confidentiality obligations.
iii. Implement and maintain appropriate technical and organizational security measures to protect Customer Data against unauthorized access, accidental loss, or unlawful processing, in accordance with the Cybersecurity Act 2020 (Act 1038).
iv. Not engage any sub-processor to process Customer Data without first informing the Merchant and providing the Merchant with the opportunity to object.
v. Assist the Merchant in fulfilling its obligations to respond to data subject rights requests, to an extent technically feasible.
vi. At the Merchant's election upon termination of this Agreement, either delete or return all Customer Data to the Merchant, and thereafter delete all copies, unless retention is required by law.
vii. Notify the Merchant without undue delay upon becoming aware of a Data Breach affecting Customer Data, and provide all information reasonably required by the Merchant to comply with its breach notification obligations to the Data Protection Commission and affected customers.
viii. Make available to the Merchant all information reasonably necessary to demonstrate Arova's compliance with its obligations as data processor under this clause.

3.4 Sub-processors

The Merchant acknowledges and consents to Arova's use of the following categories of sub-processors for the delivery of the Platform services:

i. Cloud hosting and infrastructure providers — for storing platform data.
ii. SMS delivery service providers — for sending transactional and campaign SMS to customers.
iii. Payment processing providers (Paystack) for processing merchant subscription payments.
Arova will notify the Merchant of any intended change to the above categories of sub-processors, providing the Merchant with a reasonable opportunity to object before the change takes effect.

4. SMS Communications — Compliance Obligations

4.1 Transactional SMS

i. Arova will send transactional SMS messages to the Merchant's customers on the Merchant's behalf as part of the Platform service. Transactional SMS includes points balance updates, redemption confirmations, and account notifications. The Merchant confirms that its customer enrollment process obtains appropriate consent for the sending of transactional SMS.

ii. All transactional SMS messages sent through the Platform include a standard opt-out instruction ('Reply STOP to unsubscribe'). The Platform will automatically suppress future messages to any customer who opts out.

4.2 Marketing campaign SMS

For Merchants on paid Subscription Plans who use the SMS Campaign feature, the Merchant makes the following representations and warranties on a continuing basis:

i. Every customer included in any marketing SMS campaign has explicitly opted to receive marketing SMS from the Merchant — enrollment consent alone is not sufficient.
ii. The Merchant maintains a documented opt-in record for each customer, including the date, time, and method of consent.
iii. All campaign messages comply with the National Communications Authority (NCA) Unsolicited Electronic Communications Code of Conduct, including clear sender identification and a functioning opt-out mechanism.
iv. The Merchant processes opt-out requests immediately upon receipt and does not include opted-out customers in any subsequent campaign.
v. Marketing SMS is sent only during reasonable daytime hours in the customer's local time zone.
Arova reserves the right to suspend a Merchant's access to the SMS Campaign feature immediately if Arova identifies or receives credible reports of non-compliant messaging. Arova may be required to report systematic violations to the NCA.

5. Loyalty Points — Rules and Merchant Obligations

The Merchant acknowledges and agrees that:

i. The Merchant is solely responsible for honoring all reward redemptions that the Merchant approves through the Platform — Arova's role is to record and process the redemption, not to provide the underlying benefit.

ii. Loyalty Points have no monetary value and may not be exchanged for cash, mobile money, or any financial instrument EXCEPT where such mode of exchange for cash, mobile money or any financial instrument is REDEEMABLY PERMISSIBLE by Arova Digital Enterprise or under the Merchant Service Agreement.

iii. If the Merchant intends to close their Arova account or terminate their subscription, the Merchant shall give their enrolled customers a minimum of 30 days' written notice (by SMS, in-store signage, or other reasonable means) before the effective date of closure, so that customers have a reasonable opportunity to redeem outstanding Points.

iv. Arova is not liable for any customer complaints or claims arising from the Merchant's failure to honor rewards or to give adequate notice of program termination.

6. Subscription Fees and Payment

The Merchant agrees to pay all applicable subscription fees in accordance with the plan selected at registration. Subscription fees are payable monthly or annually as selected. Arova reserves the right to change subscription pricing by giving 30 days' prior written notice to the Merchant by email. The Merchant's continued use of the Platform after a price change takes effect constitutes acceptance of the new pricing. Failure to pay fees within 14 days of the due date results in suspension of paid features. Persistent non-payment for more than 30 days may result in account termination.

7. Fraud Prevention and Conduct

The Merchant agrees to take all reasonable steps to prevent fraudulent use of the Platform, including:

i. Ensuring that staff are trained in proper transaction recording procedures.

ii. Using the Platform's daily transaction and points caps to limit exposure to staff misuse.

iii. Promptly investigating any unusual activity flagged by the Platform's fraud detection system.

iv. Reporting confirmed fraud by staff members to Arova within 5 business days.

Arova may suspend or terminate the Merchant's account without prior notice upon credible evidence of fraudulent activity. Arova reserves the right to report suspected fraud to the Economic and Organized Crime Office (EOCO) or the Ghana Police Service.

8. Confidentiality

i. Each Party agrees to keep the other Party's Confidential Information strictly confidential and not to disclose it to any third party without the other Party's prior written consent. Confidential Information includes platform configuration details, pricing arrangements, business strategies, Customer Data, and any information marked as confidential or that a reasonable person would understand to be confidential given the nature of the information and the circumstances of disclosure.

ii. This confidentiality obligation does not apply to information that is or becomes publicly available through no fault of the receiving Party, or that is required to be disclosed by law or regulatory authority.

iii. This confidentiality obligation survives termination of this Agreement for a period of 3 years.

9. Intellectual Property

i. Arova retains all intellectual property rights in the Platform, including all software, design, branding, and documentation. The Merchant is granted a limited, non-exclusive, revocable license to use the Platform solely for the purposes described in this Agreement. The Merchant may not reproduce, copy, modify, or distribute any part of the Platform without Arova's express written consent.

ii. All Customer Data remains the property of the Merchant. The Merchant grants Arova a limited license to process Customer Data solely for the purpose of delivering the Platform services.

10. Limitation of Liability

i. To the maximum extent permitted by Ghanaian law, Arova's total liability to the Merchant under or in connection with this Agreement shall not exceed the total subscription fees paid by the Merchant in the 3-month period preceding the event giving rise to the claim. Arova shall not be liable for any indirect, consequential, or special losses, or for loss of revenue, profits, or business opportunity.

ii. Nothing in this Agreement limits either Party's liability for fraud, death, or personal injury caused by its negligence.

11. Term and Termination

This Agreement commences on the Effective Date and continues until terminated in accordance with this clause.

i. Either Party may terminate this Agreement on 30 days' written notice to the other Party.

ii. Arova may terminate immediately on written notice if the Merchant commits a material breach of this Agreement and fails to remedy it within 7 days of notice, engages in fraudulent activity, or poses a risk to the Platform or its users.

iii. The Merchant may close their account by contacting hello@arovadigital.com.

On termination, the Merchant's access to the Platform ceases. The data processing provisions of this Agreement (Clause 3) and confidentiality provisions (Clause 8) survive termination.

12. Governing Law and Dispute Resolution

This Agreement is governed by the laws of the Republic of Ghana. Any dispute arising out of or in connection with this Agreement that cannot be resolved amicably between the Parties within 30 days of written notice of the dispute shall be subject to the jurisdiction of the courts of Ghana.

13. Entire Agreement and Amendments

This Agreement, together with Arova's Privacy Policy and Terms of Service (each incorporated by reference), constitutes the entire agreement between the Parties with respect to the subject matter hereof. Arova may amend this Agreement by giving 30 days' prior written notice to the Merchant. Continued use of the Platform after the effective date of any amendment constitutes acceptance.

IN WITNESS whereof the Parties hereto have hereunto set their hands and seals as authorised representatives to EXECUTE this Agreement:

Execution and Signature Placeholders

FOR AND ON BEHALF OF AROVA DIGITAL ENTERPRISE:

Name: _______________________________________________

Title / Position: _______________________________________________

Signature: _______________________________________________

Date: _______________________________________________

Company stamp (if applicable): _______________________________________________

FOR AND ON BEHALF OF MERCHANT: